The Sony Hack: Will the United States Take Countermeasures Against North Korea?
Now that the United States has concluded that North Korea was responsible for the hack into Sony’s computers, it has begun to make noises about responding to that hack in some way. If the United States wants to make its response consistent with international law, how should it think about how to proceed?
Mike Schmitt posted an excellent analysis at Just Security that walks through how to characterize the Sony hack under international law. He argues persuasively that the hack would not rise to the level of an armed attack (which would trigger a U.S. right of self-defense) or even a use of force (though the FBI is now talking about “destructive cyber attacks,” and if the attack actually destroyed physical systems rather than just data I imagine the analysis might change). But he also illustrates how, even if the cyber action did not produce physical harm, the hack nevertheless violated the customary international norm of sovereignty. Mike details many of the options the United States has to respond to this violation, including the use of “countermeasures.”